Summary

low level call

Vulnerability Details

The issue lies in the use of the low-level call function to send Ether to an arbitrary address. The call function is used to send Ether, but it also forwards all remaining gas and opens up the contract to reentrancy attacks. If the to address is a contract, it could execute a large amount of code or even call back into the vulnerable contract, enabling it to withdraw more Ether than it should.

Tools Used

vscode

Recommendations

To resolve this issue, you should replace the low-level call function with the high-level transfer function. The transfer function only forwards a limited amount of gas and does not expose the contract to reentrancy attacks. Here is how you can modify the code:

Replace this line:

with this line:

This change will make your contract more secure against reentrancy attacks. However, please note that the transfer function will throw an exception if the call fails.